Network interface supporting time sensitive networks and MACsec protection
In a general aspect, a network interface capable of processing network traffic conforming to a Time Sensitive Network (TSN) standard and a Media Access Control layer security (MACsec) standard, comprises, within an ingress path, a Physical Coding Sublayer (PCS) connected to receive a traffic stream from a network link; a Media Access Control (MAC) unit configured to split the traffic stream into a preemptable packet stream and an express packet stream; and a MACsec unit connected between the PCS and the MAC unit, configured to operate on individual fragments of a preempted MACsec protected packet in the traffic stream to produce a traffic stream with unprotected fragments for the MAC unit.
1 . A hardware network interface capable of processing network traffic conforming to a Time Sensitive Network (TSN) standard and a Media Access Control layer security (MACsec) standard, comprising, within an ingress path:
a Physical Coding Sublayer (PCS) connected to receive a traffic stream from a network link;
a Media Access Control (MAC) controller including a selector that splits the traffic stream into a preemptable packet stream and an express packet stream; and
a MACsec processing pipeline between the PCS and the MAC controller along the ingress path, the MACsec processing pipeline to remove security tags from individual starting fragments of a preempted MACsec protected packets in the traffic stream to produce a traffic stream with unprotected fragments for the MAC unit, the MACsec processing pipeline to communicate, to the MAC controller, a small fragment signal based on sizes of corresponding unprotected fragments meeting a threshold, the MAC controller to accept corresponding unprotected fragments that meet the threshold based on the small fragment signal.
2 . The network interface of claim 1 , wherein
the MACsec processing pipeline is to insert trailing padding into start fragments of the size of the security tags, and to produce corresponding effective fragment length counts for the MAC controller; and
the MAC controller is to remove the trailing padding from the modified start fragments based on the corresponding effective fragment length counts.
3 . The network interface of claim 1 , wherein the MACsec processing pipeline further comprises:
a line a Media-Independent Interface (xMII) adapter coupled with the PCS; and
an system xMII adapter coupled with the MAC controller.
4 . A method for processing incoming network traffic according to a Time Sensitive Network (TSN) standard and a Media Access Control layer security (MACsec) standard, the incoming network traffic including at least one express packet interspersed with a plurality of fragments of a preempted MACsec protected packet, comprising:
receiving the incoming network traffic and processing the plurality of fragments by using protection information conveyed in the preempted MACsec protected packet, thereby producing a modified traffic stream conveying fragments of a preempted unprotected packet, the plurality of fragments including a starting fragment;
removing a security tag from the starting fragment to produce a shortened start fragment that, based on the removal of the security tag, meets a size threshold;
based on the shortened start fragment meeting the size threshold, signaling, in association with communicating the shortened start fragment, that the shortened start fragment that met the size threshold should be accepted as one of the plurality of fragments communicated as part of the modified stream; and
receiving the modified stream and splitting the modified stream into a preemptable packet stream in which the plurality of fragments are consolidated, and an express packet stream.
5 . The method of claim 4 , further comprising:
modifying the preempted MACsec protected packet by inserting trailing padding of the size of the security tag;
producing an effective fragment length count for the starting fragment; and
upon receiving the modified stream, responding to the effective fragment length count by removing the padding from the shortened start fragment.
6 . The method of claim 4 , further comprising:
receiving the incoming network stream in a Media-Independent Interface (xMII) format, and converting it to an intermediate format suitable for processing the protection information; and
converting the modified stream from the intermediate format back to the xMII format.
7 . A method for processing network traffic according to a Time Sensitive Network (TSN) standard and a Media Access Control layer security (MACsec) standard, comprising:
receiving a preemptable packet stream and a concurrent express packet stream via a single stream having at least one express packet interspersed with a plurality of fragments of a preempted packet, the plurality of fragments including a starting fragment having a size that, when a security tag is removed from the starting fragment to create a shortened starting fragment, meets a threshold;
based on the shortened starting fragment meeting the threshold, communicating, concurrently with communicating the shortened starting fragment and via a signal line not used to communicate the shortened starting fragment, a small fragment indicator; and
based on receiving the small fragment indicator, processing the shortened starting fragment for consolidation with others of the plurality of fragment to regenerate the preempted packet.